Discuss

discuss@lists.surbl.org

2 participants
1873 discussions

SURBL reports on short links that don't exist or aren't blacklisted
by Sam Rudge 04 Aug '11

04 Aug '11

I run the URL shortener dft.ba. SURBL keeps sending out emails to us saying our shortener is being used for spam links. So far I have been sent around 50 of these messages, out of those messages most of them are for links that not only return a 404 error but were never even created in the first place. The other few all point to URLs which, although are correctly identified as spam manually, when querying the domains using the tool at http://www.surbl.org/surbl-analysis (And subsequently the system we use in our site) return as 'not blacklisted'. Our application integrates with both SURBL and WebOfTrust to get reputation for URLs and automatically removes all links we detect as spammy. But what are we to do when SURBL is informing us and our ISP of URLs that don't exist or are not even blacklisted in SURBL itself. An example of this is -- Please remove the abused shortner: http://dft dot ba /-qTY [etc] -- This URL has never existed, not 'did exist but has now been deleted' because we don't fully delete things from our database just mark them deleted, this URL has never forwarded to anything other than our 404 page. Another example of the other behaviour is this -- Please remove the abused shortner: http://dft dot ba /-NqD [etc] -- This URL did exist (but has now manually been deleted), but forwards to the domain 'li.ru', not blacklisted by SURBL. Trying to access the URL by any methods from our server (CURL, WGET etc.) returns a 500 server error so it looks like the site has blocked us from automatically figuring out where the URLs are redirecting to (I guess on an IP based block, it works from other servers). If SURBL isn't going to blacklist sites why are we being alerted that the link is being abused. Our web host says SURBL often generates "false positives that should be ignored" but I'm trying to avoid our site getting blacklisted/flagged etc. Any suggestions? -Sam

6 11

Re: [SURBL-Discuss] SURBL reports on short links that don't exist or aren't blacklisted
by gilles＠jmhsa.ch 04 Aug '11

04 Aug '11

Bonjour. En vacances, je serai de retour au bureau le lundi 15 août 2011. Merci de vous adresser en mon absence à societes(a)jmhsa.ch. Hallo. Ich bin in den Ferien und werde zurück im Büro am Montag 15. August sein. Wenden Sie sich bitte in der Zwischenzeit an societes(a)jmhsa.ch.

1 0

Re: [SURBL-Discuss] SURBL reports on short links that don't exist or aren't blacklisted
by gilles＠jmhsa.ch 03 Aug '11

03 Aug '11

1 0

Re: [SURBL-Discuss] SURBL reports on short links that don't exist or aren't blacklisted
by gilles＠jmhsa.ch 02 Aug '11

02 Aug '11

1 0

Can we provide feeds?
by StopForumSpam Support 29 Jun '11

29 Jun '11

I run stopforumspam.com and we have started taking honeypot feeds that contain URI data. Would any of this be of any use to your project? If you check any of our listings for a blue hand, then evidence of forum and blog url spam is available. keep up the great work :)

2 1

Re: [SURBL-Discuss] Can we provide feeds?
by gilles＠jmhsa.ch 29 Jun '11

29 Jun '11

Bonjour. Je suis absent du bureau et de retour jeudi 30 juin. En cas d'urgence veuillez appeler le bureau au ++41.32.729.00.20. Hallo. Ich bin nicht im Büro und wieder zurück am Donnerstag den 30. Juni. In dringenden Fällen bitte JMH anrufen ++41.32.729.00.20.

1 0

surbl listing
by Alanna Dukes 14 Apr '11

14 Apr '11

When sending a delivery test to my seedlist, one of the spam filters referenced surbl. Specifically, surbl: [c2FpbHRocnUuY29t]. Does anyone know what this means? I did a look-up for all of my company's IPs and domain and none were listed. Thanks!

2 1

Re: [SURBL-Discuss] Automatic "aging" of blacklisted entries
by Raymond Dijkxhoorn 11 Apr '11

11 Apr '11

Hi! > I have heard that entries that are older than 30 days and haven't sinned in > that time are supposed to be automatically removed from blacklists. > > Whilst this mechanism might be useful to me, I simply can't find any > information backing this up... does anyone have any information? > > It sounds like a "if you run a Blacklist, here's a list of rules to ensure > you are fair" sort of convention, as I can't see how it could be > enforceable. As far as I can tell, the best way to ensure a Blacklist > contains accurate and fair entries is to see who uses it a la SpamAssassin. There is no public information about that, not for SURBL since its not a per default pick. Any domain can get a specific listing criteria. So there is no such thing as you mention above. Not for SURBL at least. Some entry's will never expire for example. This has nothing to to with beeing fair. We have various ways of testing accuracy, SpamAssassin mass checks is one just of them. Bye, Raymond.

1 0

Re: [SURBL-Discuss] Automatic "aging" of blacklisted entries
by gilles＠jmhsa.ch 11 Apr '11

11 Apr '11

Bonjour. Je suis absent du bureau et de retour mercredi 13 avril. En cas d'urgence veuillez appeler le bureau au ++41.32.729.00.20. Hallo. Ich bin nicht im Büro und wieder zurück am Donnerstag den 13. April. In dringenden Fällen bitte JMH anrufen ++41.32.729.00.20.

1 0

Re: [SURBL-Discuss] [SURBL-Announce] ANNOUNCE: Some two-level-tlds accented characters changed to IDN
by Michele Neylon :: Blacknight 11 Apr '11

11 Apr '11

Interesting issue Has SURBL got anything in place to deal with IDN ccTLDs? ie. where the actual extension is an IDN as well? Regards Michele On 4 Apr 2011, at 16:54, SURBL Announcement list [READONLY] wrote: > Anthony Howe noticed that gcc was complaining about ISO 8859-1 > accented characters used in the two-level-tlds file. With his kind > help, we converted those to equivalent IDN representation. Diffs are: > > 278c278 > < aéroport.ci > --- >> xn--aroport-bya.ci > 893c893 > < drøbak.no > --- >> xn--drbak-wua.no > 1955c1955 > < lea?gaviika.no > --- >> xn--leagaviika-52b.no > 2835c2835 > < osterøy.no > --- >> xn--ostery-fya.no > 3554c3554 > < tysvær.no > --- >> xn--tysvr-vra.no > 3587c3587 > < unjárga.no > --- >> xn--unjrga-rta.no > 3650c3650 > < vegårshei.no > --- >> xn--vegrshei-c0a.no > > As a practical matter this should have little operational impact since > those domains are obscure and unlikely to be abused. Nonetheless, we > thank Anthony for the correction. > > _______________________________________________ > Announce mailing list > Announce(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/announce Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.mobi/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

3 2

← Newer
1
2
3
4
5
6
7
8
9
...
188
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss